service

type AEAD interface {
	// Encrypt encrypts plaintext with optional AAD and returns ciphertext and nonce.
	Encrypt(plaintext, aad []byte) (ciphertext, nonce []byte, err error)

	// Decrypt decrypts ciphertext using the provided nonce and AAD.
	Decrypt(ciphertext, nonce, aad []byte) ([]byte, error)
}

type AEADManager interface {
	// CreateCipher creates an AEAD cipher instance for the specified algorithm.
	CreateCipher(key []byte, alg cryptoDomain.Algorithm) (AEAD, error)
}

type AEADManagerService struct{}

type AESGCMCipher struct {
	// contains filtered or unexported fields
}

type ChaCha20Poly1305Cipher struct {
	// contains filtered or unexported fields
}

type KMSService interface {
	// OpenKeeper opens a secrets.Keeper for the configured KMS provider.
	// Returns an error if the KMS provider URI is invalid or connection fails.
	OpenKeeper(ctx context.Context, keyURI string) (cryptoDomain.KMSKeeper, error)
}

type KeyManager interface {
	// CreateKek creates a new KEK encrypted with the master key.
	CreateKek(
		masterKey *cryptoDomain.MasterKey,
		alg cryptoDomain.Algorithm,
	) (cryptoDomain.Kek, error)

	// DecryptKek decrypts a KEK using the master key.
	DecryptKek(kek *cryptoDomain.Kek, masterKey *cryptoDomain.MasterKey) ([]byte, error)

	// CreateDek creates a new DEK encrypted with the KEK.
	CreateDek(kek *cryptoDomain.Kek, alg cryptoDomain.Algorithm) (cryptoDomain.Dek, error)

	// DecryptDek decrypts a DEK using the KEK.
	DecryptDek(dek *cryptoDomain.Dek, kek *cryptoDomain.Kek) ([]byte, error)
}

type KeyManagerService struct {
	// contains filtered or unexported fields
}